262233 matches found
CVE-2026-44979
@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing...
CVE-2026-13473
creationtimestamp| type| source ---|---|--- 2026-07-17 21:54:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mquqgymxyv24 2026-07-18 18:01:23+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwtv254kw2g...
CVE-2026-48062
CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...
CVE-2026-53727
cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...
CVE-2026-49485 HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...
CVE-2026-54335 Feathersjs: Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__
Feathersjs is a framework for creating web APIs and real-time applications with TypeScript or JavaScript. In 5.0.44 and earlier, the .mergetarget, source utility exported by @feathersjs/commons recursively merges source into target by iterating Object.keyssource. When source was produced by...
CVE-2026-54498
viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...
CVE-2026-54547
creationtimestamp| type| source ---|---|--- 2026-07-17 20:35:06+00:00| published-proof-of-concept| https://github.com/pipeboard-co/meta-ads-mcp/security/advisories/GHSA-2v2f-mvfg-ph56...
CVE-2026-54243
CVE-2026-54243 affects Statamic CMS (Laravel/Git-powered). Prior to 5.73.24 and 6.20.1, form submission values exported to CSV via CsvExporter.php were not neutralized for spreadsheet formula characters. A value starting with =, +, -, or @ could be interpreted as a live formula when an editor ope...
GHSA-GC92-VPV6-2C4W vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-HGVH-MHW9-C77H vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-MC7H-7X47-9J48 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-PH5F-PJVP-H9X6 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15777 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-6GFG-HH9C-WX87 vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-8481
creationtimestamp| type| source ---|---|--- 2026-07-17 20:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqulbowbpo2v 2026-07-17 22:41:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqut2zsykr24 2026-07-18 14:01:40+00:00| seen|...
DEBIAN-CVE-2026-50162
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through...
CVE-2026-50289
systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces5 source directive because lib/network.js checkLinuxDCHPInterfaces reads /etc/network/interfaces, extracts a...
UBUNTU-CVE-2026-48978
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...
UBUNTU-CVE-2026-49852
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption JOSE standards. Prior to 1.6.8, joserfc.jwt.decode accepts attacker-forged HMAC-signed tokens when the caller-supplied verification key is the empty string or None, because HMACAlgorithm.sign...